System and method of post event/alarm analysis in cctv and integrated security systems

ABSTRACT

A method and apparatus are provided. The method includes the steps of detecting a plurality of events within a secured area detected by respective sensors that have been activated within a predetermined time period of one another and wherein at least one of the plurality of events is an alarm event, ordering the events based upon a reporting time of each event and displaying a map showing the activated sensors within the secured area along with the potential route of an intruder traveling among the locations of the activated sensors in accordance with the reporting time of each event.

FIELD

The field of the invention relates to security systems and moreparticularly to methods of monitoring security systems.

BACKGROUND

Security systems for homes are businesses are generally known. Suchsystems are typically based upon the use of a physical barrier around asecure area combined with one or more sensors of life or safety events.

A life or safety event could include the detection of an intruder or ofa fire. In the case of a fire, the sensors could be based upon any of anumber of different sensor technologies (e.g., smoke detection, carbonmonoxide detection, etc.).

In the case of intrusion, the sensors could include one or moreperimeter sensors (e.g., limit switches on doors or windows) to detectentry of intruders. One or more passive infrared (PIR) sensors or motiondetectors may also be provided within an interior of the protected spaceto detect intruders who have entered without detection by the perimetersensors.

In large facilities, a number of television cameras incorporated into aclosed circuit television (CCTV) system may be distributed throughoutthe secure area in order to detect intruders. A person (e.g., a guard)at a guard station may view a television monitor coupled to the camerasin order to directly observe the presence of intruders.

While such systems work well, it is often difficult to comprehend thetrue nature of any situation in a large facility that may contain dozensof security cameras and sensors. In such cases, it is often necessary toreview recorded video from each of the cameras in order to conduct aforensic review of an event. Because of the difficulties presented bylarge systems, a need exists for better methods of analyzing securityevents.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an alarm system shown generally inaccordance with an illustrated embodiment;

FIG. 2 is a flow chart of steps that may be followed by the system ofFIG. 1;

FIG. 3 depicts a screen that may be shown on the display of FIG. 1;

FIG. 4 depicts a map of events that may be detected within the system ofFIG. 1;

FIG. 5 depicts the map of FIG. 4 along with a potential route of anintruder traveling among the sites of the security events; and

FIG. 6 depicts a panel display of the security events.

DETAILED DESCRIPTION OF AN ILLUSTRATED EMBODIMENT

FIG. 1 is a block diagram of a security system 10 used to provideprotection to a secured area 12 shown generally in accordance with anillustrated embodiment. Included within the system 10 may be a number ofsensing devices. The sensing devices may include sensors 16, 18 and anumber of cameras 20, 22, 48. The sensors 16, 18 may be intrusionsensors (e.g., door or window switches) that detect a security eventsuch as an intruder opening or breaking a window or door. Alternativelyor in addition, the sensors may include one or more PIR motion detectorsor environmental detectors (e.g., smoke detectors, carbon monoxidedetectors, etc.) that detect environmental events.

The cameras 20, 22, 48 may be conventional analog cameras or smartcameras. Cameras 20, 22 may have a field of view covering the interiorof the secured area while camera 48 may be an exterior camera. Whereprovided as smart cameras, the cameras 20, 22, 48 may include aninternal hardware processor with the processing capability to detectmotion within a field of view of the camera 20, 22, 48.

The sensors 16, 18 and cameras 20, 22, 48 may be coupled to a controlpanel 14 of the security system 10. Included within the control panel 14may be one or more processors 24, 26 embodied as hardware and where eachprocessor operates under control of one or computer programs 28, 30loaded from a non-transient computer readable medium (memory) 32.

The system 10 may also provide data to and receive instructions from acomputer terminal 34. A security system operator (person) 38 may use auser interface 42 of the terminal 34 to select and view images from eachof the cameras 20, 22, 48 in real time on a display 36. The operator 38may also select a camera 20, 22, 48, enter a time and date through theuser interface 42 and view images from the camera 20, 22, 48 that havebeen previously recorded and saved in a video recorder 44.

In general, the system 10 may include an alarm processor 24, 26 thatcontinuously monitors the sensors 16, 18 and cameras 20, 22, 48 forsecurity events. Security events may be divided into alerts thatrepresent suspicious activity and alarm events. Alarm events may includethe detection of a fire by one of the sensors 16, 18 or of the presenceof an intruder by a PIR or detector camera. In the event of an alarmevent, the alarm processor 24, 26 may automatically display notificationof the alarm event on the display 36.

In addition, to displaying an alarm notification on the display 36, thealarm processor may also create an event record and save a copy of theevent record in a file 48, 50 stored in memory 32. The event record mayinclude a time (time stamp) of the event and an identifier of the sensor16, 18 or camera 20, 22 that detected the event.

The alarm processor 24, 26 may also compose an alarm message and forwardthe alarm message to a central monitoring station 40. The centralmonitoring station 40 may respond in an appropriate manner (e.g., notifya local police or fire department, summon a local security service,etc.).

In contrast, security alerts may be processed by the alarm processor 24,26 or by one or more separate alert processors 24, 26 provided for thatpurpose. For example, an entry processor 24, 26 may processidentification information from a user interface (e.g., keypad, a keycard reader, fingerprint or iris scanner, etc.) 46 located adjacent anentrance upon entry of an authorized person through the entrance/exitportal (e.g., a door) 44. The user interface 46 may be located insidethe secured area 12 (as shown in FIG. 1) or be located outside.

In this case, the alarm processor 24, 26 may detect opening of the door44 via one of the sensors 16, 18 while in an armed state and enter adelay mode pending receipt of authorization entered through the userinterface 46 and received from the entry processor 24, 26. Upon receiptof the authorization from the entry processor, the alarm processor maycancel the alarm event caused by the opening of the door 44 and enter analarm stay mode. Alternatively, the alarm processor may simply disableinterior intrusion detectors.

On the other hand (and in the alarm stay mode), one or more of thecameras 20, 22 may continue to process images from the interior of thesecure area 12. For example a tracking processor 24, 26 may processimages from one or more of the cameras 20, 22, 48 to detect suspiciousactivity. For example, if the tracking processor should detect twopeople entering through the door 44 while authorization was receivedfrom the entry processor for only one person, then the trackingprocessor (or alarm processor) may issue a security alert. The securityalert may presented on the display 36 or saved as a security eventwithin a file 48, 50 along with a time of the event, an identifier ofthe camera and user identifier received through the interface 46.

Alternatively, a processor 24, 26 (loitering processor) may monitor forloitering in specific areas. For example, a person loitering near a door44 without opening the door for a predetermined time period may beinterpreted as awaiting the approach of an unauthorized person and anattempt to allow entry by an unauthorized person. In this case, theloitering processor may save or issue a security alert as describedabove.

Other examples may include respective alert processors 24, 26 thatdetect the disabling of a camera 20, 22. In this case a correspondingtampering processor 24, 26 may monitor video from each camera 20, 22 andupon loss of video, the processor may issue and save a security alert.

Similarly, a door processor may monitor fire doors (even in a disarmedstate). In this case, the opening of a fire door that is not normallyused as an exit or entrance may trigger issuing and saving of acorresponding security alert in a file 48, 50.

Alternatively, a head count processor 24, 26 may count people enteringand leaving the secure area 12 via the portal 44 and user interface 46.If the head count processor counts a greater number of people thanauthorized inside the secure area 12 (suggesting the presence of one ormore unauthorized persons), then the head count processor may issue andsave a security alert in a corresponding file 48, 50.

In addition to detecting and presenting security alerts in real time,the system 10 also includes a correlation detection and presentationprocessor 24, 26 that detects two or more security events that arerelated through a correlation established by time and location.Correlated in time simply means that the related security events occurwithin some predetermined time period. Correlation by location meansthat the correlated events occur close enough together such that theymay all also share the same root cause. For example, related securityevents may be displayed on a geographic map of the secured area with thecorrelation of locations indicated generally by their relative locationson the map and the correlation of time depicted as the potential path ofan intruder traveling from one location to the other based upon therespective times of the events.

In this regard, the correlation processor may base the evaluation ofcorrelations upon the content of a correlation file that identifiesmaster devices, alarm states and configuration groups within the system10. In this regard, one or more master devices may be designated by theuser 38 and used as a basis for the presentation of correlatedinformation and based upon a state of the alarm system 10. Thepresentation of correlated information may occur automatically basedupon receipt of an alarm (or security event) or manually at theconvenience of the operator 38.

In this regard, configuration groups may be designated in conjunctionwith a master device and used to allow the operator 38 furtherinvestigate the correlated information. For example, any sensor 16, 18or camera 20, 22 with motion detection may be designated as a masterdevice in the armed or disarmed state. Other cameras 20, 22 with a fieldof view proximate the designated master device may be grouped with themaster device as a source of further information based upon distancefrom the designated master device. A processor 24, 26 that detectsspecific types of information (e.g., count of people, detection ofmotion, etc.) could also be designated as the master device.

As a further example, a camera 20, 22 inside the secured area 12 withmotion detection and a field of view that includes the door 44 may bedesignated by the operator 38 as a master device in an alarm stay ordisarmed state of the alarm system 10. Other cameras 20, 22 proximatethe master device may be grouped with the master device as a source ofvideo information in order to investigate events associated with thedoor 44.

Correlated information may be presented to the operator 38 based uponthe state of the alarm system and activation of a designated masterdevice. For example, a sensor 16, 18 on a fire door 44 may be designatedas a master device in the disarmed state. Upon activation of the masterdevice, the correlation processor may search the event records 48, 50 toidentify other security events that are related by time and location.The correlation in time may mean that the other security events occurredwithin some predetermined time period (e.g., 15 minutes) in the samegeneral location as the location of the activated master device.Alternatively, the correlated distance may be a variable distance valuecalculated by a corresponding processor where the calculated distanceincreases with time based upon the normal walking speed of an intrudermeasured from the time of activation of the master device.

FIG. 2 depicts a flow chart of process steps that may be followed by thecorrelation processor. Reference will be made to the elements of FIG. 2as appropriate in the following discussion.

FIG. 3 depicts information that may be shown to the operator 38 on thedisplay 36 during normal operation. Shown in the upper left corner is awindow of currently received security events. It may be assumed forpurposes of explanation that the reporting device of at least some ofthe currently received security events has been previously designated asa master device. As shown in FIG. 3, it may be assumed that the operator38 has selected 104 the “Camera motion detection” alarm to activate inorder to perform post event analysis via the correlation processor.

In response, a relationship processor 24, 26 calculates 106 thelogically related and/or relevant alarms. The relevant alarms may bebased upon the time of the event, the location, the identification ofthe master device and the grouping of devices.

A display processor 24, 26 may display 112 the security event details asdepicted in FIG. 4. In this case (in FIG. 4), the selected device(camera 3) is depicted on a geographic map of the secure area 12.

FIG. 5 shows the map of the secured area 12 along with the correlateddetails. Included within FIG. 5 is a window 202 of correlated eventswith a time of the correlated event, an identifier of the device and anevent description. Also shown in FIG. 5 is the potential route 204 of anintruder traveling among the locations of the activated sensors inaccordance with a reporting time of each event.

In this case, the correlation processor identifies and orders foursecurity events (i.e., alarm numbers 1, 2, 4 and 5) that may beassociated with the selected event (i.e., alarm number 3) based upon thetime of each event. The selected alarm event is shown to have occurredat 3:30 am, while associated alarm events 4 and 5 occurred at 3:33 amand 3:39 am, respectively. The correlation processor has also identifiedtwo other alarm events (i.e., pre-alarm events 1 and 2) that occurredbefore the selected alarm event.

The correlation processor has also determined from the times of therespective events that the events could be correlated in distancebecause the difference in times between the events is such that anintruder could have traveled (e.g., walked) from the location of oneevent to the next. In this case, the selected alarm event (alarm number3) occurred at 3:30 am while pre-alarm 2 occurred at 3:17 am, therebyallowing 3 minutes for the intruder to walk from the location of doorcontact 7 to camera 3. As such, the correlation processor identifies theroute from door contact 7 to camera 3 is a potential route of anintruder that correlates or otherwise links alarm number 3 withpre-alarm event 2. In response, the correlation processor adds thepotential route of the intruder to the map as the solid line connectingcamera 3 and door contact 7. In a similar manner, the correlationprocessor correlates and adds a solid line (potential intruder route)between camera 3 and the camera sabotage of cameral 9 because they weredetected only 3 minutes apart.

The correlation processor uses a similar process to link alarm number 5(door forced open) to alarm number 4 and adds the solid line to indicatea further potential route of the intruder between the locations ofaccess door 18 and camera 9. In the same manner, the correlationprocessor correlates alarm number 1 (detected scene change) to alarmnumber 2 and adds the solid line to indicate a further potential routeof the intruder between the locations of door contact 7 and camera 7.

As shown in FIG. 5, the correlation processor is able to quickly apprisethe operator 38 of one possible way in which two or more events may beinterpreted. Once apprised of the possibilities, the operator mayperform a further investigation. One way that the operator 38 may dothis is to individually select a panel view of the correlated events inorder to view video associated with one or more of the correlatedevents. The selection of the panel view may be accomplished via aseparate button on the user interface 42 or simply clicking on the panel202.

Shown in FIG. 6 is an example of a panel display of the correlatedevents. In this case, the correlation processor (or a separate displayprocessor 24, 26) may select the most appropriate video source (e.g.,camera) for presentation of the correlated events. In the case of alarmevent 2 involving the door contact 7, the correlation processor mayselect a camera that has been previously grouped with or is logicallylinked to door contact 7.

FIG. 6 shows still frames for each of alarm events 1-5 captured at theinstant of the respective event. The largest window on the display maybe the originally selected event (i.e., alarm 3). Other windows adjacentthe largest window may display respective images from the correlatedevents. Shown on the lower right corner of FIG. 6 is the map of FIG. 5.The user may toggle between the map of FIG. 5 and the panel of FIG. 6 byselecting the map on the lower right of FIG. 6 and the panel 202 of FIG.5.

In this regard, the images shown in FIG. 6 may be retrieved from theinformation contained in the event files 48, 50. The identifier of thecamera and time of the event is retrieved from the event files 48, 50.Using this information, the presentation processor may retrieve theappropriate frames from the recorder 44.

Using the panel view of FIG. 6, the user may continue his/herinvestigation of the events. For example, the user may select the largewindow of FIG. 6 (camera 3) and activate the user interface 42 to scrollforwards and backwards in time in order to view images captured prior orsubsequent to the detected event within the windows of FIG. 6.Alternatively, selection of the large window may cause the associatedprocessor to display a sequence of images from the associated camera fora predetermined time before and after the reporting time of the event.

Alternatively, the user may select one of the windows of the correlatedwindows of FIG. 6 (e.g., Post alarm 1). In this case, the image fromcamera 9 may replace the image of camera 3 in the large window in theupper left corner of FIG. 6. As above, the user may scroll forwards andbackwards in time to continue his/her investigation of the events.

As the images from the respective events are displayed on the largewindow of FIG. 6, the user may also access the images of cameras thatare grouped with the selected camera. For example, by double clicking onthe large window of FIG. 6, the display processor may display a menu ofcameras that are included within the same group. In this way, the usermay click on of the icons of cameras from the same group to scrollthrough different views of the scene that originated the event.

Alternatively, cameras that are near the scene of the correlated eventsmay be shown as a separate icon on the map of FIG. 5. In this way, theoperator may click on an icon of the camera from the map of FIG. 5 toview other views of the scene of the detected event.

FIGS. 1-5 depict examples of apparatus and method steps performed bythat apparatus to analyze events. The method may include the steps ofdetecting a plurality of events within a secured area detected byrespective sensors that have been activated within a predetermined timeperiod of one another and wherein at least one of the plurality ofevents is an alarm event, ordering the events based upon a reportingtime of each event and displaying a map showing the activated sensorswithin the secured area along with the potential route of an intrudertraveling among the locations of the activated sensors in accordancewith the reporting time of each event.

Similarly, the apparatus may include a plurality of devices that detecta plurality of respective events within a secured area, a processor thatdetects the respective devices have been activated within apredetermined time period of one another and wherein at least one of theplurality of events is an alarm event, a processor that orders theevents based upon a reporting time of each event and a processor thatdisplays a map showing the activated devices within the secured areaalong with the potential route of an intruder traveling among thelocations of the activated devices in accordance with the reporting timeof each event.

Alternatively, the apparatus may include a plurality of event recordsembodied as files saved in a non-transitory computer readable medium,the events plurality of devices that detect a plurality of respectiveevents within a secured area where the respective sensors that have beenactivated within a predetermined time period of one another and whereinat least one of the plurality of events is an alarm event, a processorthat orders the events based upon a reporting time of each event and aprocessor that displays a map showing the activated sensors within thesecured area along with the potential route of an intruder travelingamong the locations of the activated sensors in accordance with thereporting time of each event.

Although a few embodiments have been described in detail above, othermodifications are possible. For example, the logic flows depicted in thefigures do not require the particular order shown, or sequential order,to achieve desirable results. Other steps may be provided, or steps maybe eliminated, from the described flows, and other components may beadded to, or removed from, the described systems. Other embodiments maybe within the scope of the following claims.

1. A method comprising: detecting a plurality of events within a securedarea detected by respective sensors that have been activated within apredetermined time period of one another and wherein at least one of theplurality of events is an alarm event; ordering the events based upon areporting time of each event; and displaying a map showing the activatedsensors within the secured area along with the potential route of anintruder traveling among the locations of the activated sensors inaccordance with the reporting time of each event.
 2. The method as inclaim 1 wherein the predetermined time period further comprises awalking time of the intruder between the respective locations of theactivated sensors.
 3. The method as in claim 1 wherein the plurality ofsensors further comprises at least one camera.
 4. The method as in claim3 wherein the detected alarm event further comprises the cameradetecting motion in a field of view of the camera.
 5. The method as inclaim 4 further comprising an operator selecting an icon of the cameraon the displayed map and viewing a sequence of images from the cameracaptured at the reporting time of the event from the camera.
 6. Themethod as in claim 1 further comprising depicting an icon of a nearbycamera on the displayed map where a field of view of the cameraencompasses one of the plurality of activated sensors.
 7. The method asin claim 6 further comprising an operator selecting the icon of thecamera and viewing a sequence of images from the camera at the reportingtime of the event detected by the activated sensor.
 8. The method as inclaim 6 further comprising an operator selecting the icon of the cameraand viewing a sequence of images from the camera for a predeterminedtime before or after the reporting time of the event detected by theactivated sensor.
 9. The method as in claim 1 wherein the plurality ofdetected events further comprise granting access by an authorized personto the secured area and detecting simultaneous entry into the securearea through the same entry portal by another person in addition to theauthorized person.
 10. The method as in claim 1 further comprisingdepicting a list of selectable icons on the displayed map where eachselectable icon corresponds to one of the plurality of activatedsensors.
 11. The method as in claim 1 further comprising at least someof the plurality of events occurring before the alarm event.
 12. Anapparatus comprising: a plurality of devices that detect a plurality ofrespective events within a secured area; a processor that detects therespective devices activated within a predetermined time period of oneanother and wherein at least one of the plurality of events is an alarmevent; a processor that orders the events based upon a reporting time ofeach event; and a processor that displays a map showing the activateddevices within the secured area along with the potential route of anintruder traveling among the locations of the activated devices inaccordance with the reporting time of each event.
 13. The apparatus asin claim 12 further comprising a processor calculating the predeterminedtime based upon a distance between the respective locations of theactivated sensors and an average walking speed of the intruder.
 14. Theapparatus as in claim 12 wherein the plurality of sensors furthercomprises at least one camera.
 15. The apparatus as in claim 14 furthercomprising a processor associated with the camera that detects motion ina field of view of the camera.
 16. The apparatus as in claim 15 furthercomprising a panel view of the detected events selectable from the map.17. The apparatus as in claim 16 further comprising an icon of anothercamera displayed on the panel view where a field of view of the othercamera encompasses one of the plurality of activated sensors.
 18. Theapparatus as in claim 17 further comprising an operator selecting theicon of the camera and a processor that displays a sequence of imagesfrom the camera for viewing at the reporting time of the event detectedby the activated sensor.
 19. The apparatus as in claim 12 furthercomprising a processor that detects the granting of access to anauthorized person into the secured area and that detects simultaneousentry into the secure area through the same entry portal by anotherperson in addition to the authorized person.
 20. An apparatuscomprising: a plurality of event records embodied as files saved in anon-transitory computer readable medium, the event records eachcontaining a record of activation of one of a plurality of devices thatdetect a plurality of respective events within a secured area where therespective sensors of the event records have been activated within apredetermined time period of one another and wherein at least one of theplurality of events is an alarm event; a processor that orders theevents based upon a reporting time of each event; and a processor thatdisplays a map showing the activated sensors within the secured areaalong with the potential route of an intruder traveling among thelocations of the activated sensors in accordance with the reporting timeof each event.